22 ms·

Airbus hit by series of cyber attacks on suppliers

289 points by keydutch 7y ago

stanski 7y ago
I hear good things about this MCAS thing Boeing is doing. Maybe it's worth copying.
- JadeNB 7y ago
  Maybe you're being sarcastic, but this seems unrelated. The attacks are on internal networks with an attempt to gain unauthorised access to technical data; it seems to have nothing directly to do with attacks on the software that directly flies the plane.
  - magduf 7y ago
    No, but perhaps it is coming from the same organization that thought MCAS was a great idea. After all, such an organization obviously has severe deficiencies with basic systems engineering; what other deficiencies might it have?
    - Tronno 7y ago
      The article clearly states China was believed to be responsible.
      - stevefan1999 7y ago
        ...what does Chinese gain from these attacks then? International infamy?
        munmaek 7y ago
        Valuable aviation intel to use for their young, but growing, airline industry.
        netsharc 7y ago
        Makes me wonder if it'd be simpler to gain this stuff the old-fashioned spy way: bribe or blackmail someone working in one of those supplier companies. If Pierre in Toulouse is desperate to hide his affair with the Chinese girl he met a week ago in the bar...
        vonmoltke 7y ago
        Oh, that certainly happens as well. It's just harder to pull off, because physical security at these companies (even physical computer security) is well ahead of network security.
        magduf 7y ago
        Or the other way: just buy it outright. Either buy from the supplier companies, or buy existing stuff used and reverse-engineer it.
        WillPostForFood 7y ago
        This isn't denial of service attack, this is unauthorized access to steal technical data.
        stevefan1999 7y ago
        I wouldn't call it cyberattack then; rather it should be cyberespionage
        MS90 7y ago
        Stealing blueprints and other technical data so they can make their own knockoffs of western aircraft, as they have with the J-20 (F-22 knockoff) and J-31 (F-35 knockoff).
    - qubex 7y ago
      That’s a cheap shot and a risible one at that. The hierarchy of decision-makers who designed and implemented MCAS and the hierarchy of decision-makers who handle the information security at Boeing is (as I’m sure you’re well aware) so far removed and unrelated to each-other as to be essentially distinct. Conway’s Law doesn’t really apply here.
      - wil421 7y ago
        Exactly. A rogue bunch of MCAS engineers hacking Airbus is not based on any kind of reality.
    - wil421 7y ago
      Both of you provide some sources or anything more than “I could imagine X...because Boeing has been in the news lately.”.
JamesSchriver 7y ago
It is utterly fascinating to me how the west could have so completely and utterly lost its mind to so willingly and submissively capitulate and surrender, nay, self-sacrifice itself at the altar of foreign enemies that seem to now have possibly reached terminal state. It is akin to the constant muslim harassments and raids and invasions of Europe during a time of weakness in Europe along the Mediterranean in particular where a population was dispersed and too unorganized to fend off the constant muslim raids, enslavement, harassed, and invasion to the point that the muslims invaded on both the eastern and western fronts, only to hold Spain to varying degrees for 600 years. Today, China constantly raids and plunders the west of hard earned and produced technology and products and knowledge, while the ruling populace is weak in will and character, let alone principle, to hold back and defend against, let alone launch deterrent assaults on the clear enemy that is dismantling their whole culture and society bit by bit. I guess some in the self-immolating and self-hating and self-destructive west seem to believe that a world not stewarded by the west will somehow be a better place, when every single objective indicator clearly states that that will not at all be the case by a wide margin. Reality is that there are exactly zero scenarios where world stewardship will last in anything remotely resembling some kind of "equal" stewardship and say in all aspects. No, there is not a single path that does not lead to some one entity dominating the others, and the likelihood of the west being that leader again, is far fetched. So we are left with a prospect of Chinese strangulation of the world under communist oppression and tyranny akin to how it ruthlessly manages its chattel humans, only worse, because everyone else is not even Chinese. I don't think people have really started to even understand what has been done over the last several decades as the west has essentially not only dismantled itself, lost its identity, and even self-harmed and polluted and salted its soul. When there is a huge war that needs to be fought with hundreds of thousands of troops against the Chinese and possibly their numerous allies who have been promised spoils from the conquest of the west, who in the west will fight for the west? … the throngs of dissociated "immigrants" that have no loyalty or association or cultural affinity towards the west they freeload off and who's care about immediately dissipates once the benefits are withdrawn? The white men who have been degraded and disowned of their culture, identity, and lands as throngs of foreign legions of "immigrants" are teated better than they, the heirs of the men that created the civilized world we all benefit from while most immigrants and freeloading types revile and fully disrespect what they have yet never earned? Will white men be asked to go fight and die in a dysgenic war so foreigners that beset their lands can inherit the spoils either way? These are all real and legitimate questions that need to be asked. Who will defend this thing everyone loves freeloading off, yet does not want to contribute to, let alone respect the people who built it, even in their own homes? Good luck winning a massive war against Russian and Chinese forces with a demoralized western fighting force that does not know why it is fighting or defending, while the Chinese and their compatriots will be well aware that they are fighting to ascent to control.
joaomacp 7y ago
Out of curiosity: why is China not mentioned in the article's title, when the first sentence states a "Chinese state-sponsored hacking operation"?
- eganist 7y ago
  It took my vouch to un-dead your comment, useful because I couldn't reply to it otherwise. I'm morbidly fascinated as to how the top two comments on this submission were marked dead in the first place, but considering it took a vouch to automatically bring it back to life, there's a hint of a Flag brigade on this thread. To answer your comment: because the title of the submission "Airbus Suppliers Hit in State-Sponsored Attack" and the title of the article "Airbus Suppliers Hit in State-Sponsored Attack" are identical, and that's totally fine. Changing the title of the submission to include a detail from the article actually editorializes the submission, which is not ideal for HN or the audience here.
  - jiveturkey 7y ago
    I took the comment to mean, why does the original article's title not have 'Chinese' in the title. In these days of click-bait "news", it's a valid question.
  - yorwba 7y ago
    The user you're replying to has been leaving a trail of dead comments since https://news.ycombinator.com/item?id=14150381 https://news.ycombinator.com/item?id=14150381 If it's marked as [dead] but not [flagged], the comment was killed automatically. No reason to suspect brigading.
  - dang 7y ago
    Please don't post insinuations of astroturfing or similar manipulation ("Flag brigade") without evidence. If you're concerned about abuse, please follow the site guidelines and email hn@ycombinator.com so we can look into it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
cde-v 7y ago
Seems like Boeing is getting pretty desperate to fix their MCAS issues.
raxxorrax 7y ago
My first question would be if the Chinese hacker is American looking or if he is named Boejing Wang or something like that. Jokes aside there are a huge number of mobile devices with saved credentials for exclusive business VPN access and a lot of businesses restrict access to resources based on the source of requests, which can be the corporate network of a supplier. This is often done to enable some forms of electronic data interchange. Putting these services in another network would probably have helped. It would be my guess that the hacker gained access through a privileged network with stolen VPN credentials. There would be countless ways to achieve that. Perhaps pickpockets should just sell the stolen phones to relevant companies.
- taxidump 7y ago
  I am not following your borderline racist comment about a name. Why do you assume stolen credentials? Low hanging fruit could be the entry point, but advanced attacks are common with state actors so this is highly assumptive and brings nothing to the discussion.
KoftaBob 7y ago
Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products. Goes to show that without easy access to product blueprints/IP at the factories, China is very slow to actually innovate on their own. Hence why I feel the "China will outpace everyone in tech and take over the world" is super overblown. Even their university culture practically encourages cheating in classes to pass, so you have generations of students graduating with weak understanding of the fundamentals. The US is obviously not a perfect meritocracy, but China is super far from that. An economic model where American/European/Japanese/Korean tech is stolen and then friends of politicians are gifted CEO positions of companies that clone that stolen tech...not sustainable at all. If you want a painful example of what I'm talking about, watch the AI debate between Jack Ma and Elon Musk. It's so clear that Ma has an absolutely minuscule understanding of the AI landscape. When robotic manufacturing eventually becomes cheaper and faster than manufacturing in China, meaning they'll no longer have IP to steal, they are in huge trouble.
- notahacker 7y ago
  Airbus has been manufacturing in China for a while now and Boeing opened a plant more recently. China doesn't make internationally competitive aircraft because making internationally competitive aircraft is very hard.
  - KoftaBob 7y ago
    "Asked about the possibility of technology transfer agreements between Boeing and COMAC, Bruns stressed that the purpose of the plant was for installing seats, painting vehicles, and completing the planes’ final delivery. “That’s only a part of what we do in the production of airplanes,” he said."
  - mikepurvis 7y ago
    They're way behind schedule, but they are working on it. A recent Wendover video looked at the current state of affairs: https://www.youtube.com/watch?v=XjbYloKJX7c https://www.youtube.com/watch?v=XjbYloKJX7c
- 7y ago
rossdavidh 7y ago
So, it used to be that saying anything remotely skeptical about Bitcoin was the way to get downvoted on HN. Nowadays, it seems that saying anything negative about China is how. Although, in the field of aeronautics, it is not like China is the only "state sponsor" to engage in espionage, or that this is anything new for any of the major powers.
- swarnie_ 7y ago
  You want to try writing something vaguely anti-USA, that's when they really come out to get you.
- avocado4 7y ago
  HN / Reddit votes are very easy to manipulate with State-backed funding. Best to ignore the "consensus" on online boards and make one's own decision based on available evidence.
  - dang 7y ago
    Please don't post insinuations about astroturfing without evidence. It poisons the well, and the overwhelming majority of such comments are based on imagination only. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20astroturfing&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
    - deleted 7y ago
      [deleted]
    - munificent 7y ago
      Honest guestion: I understand that unfounded allegations of astroturfing are not helpful. But does HN have systems in place to avoid malicious manipulation like this?
      - dang 7y ago
roymurdock 7y ago
Other comments here incorrectly pointing out that Boeing and Airbus don't manufacture in China - they do. And why wouldn't they, it's obviously much cheaper to manufacture there given material and labor costs. Obviously they don't manufacture highly sensitive military aircraft in China, but commercial aircraft, sure why not. What they don't do is the design, testing, and certification in China. This is the real IP - not the materials or the assembly techniques, but how to navigate the regulatory landscape of the FAA and the EASA in extremely complex hardware/software integrated systems. The article mentions certification documents/evidence as a primary target. The funny thing in all this is that passengers inherently trust the FAA and EASA operated system and inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft. When really this breach was all about the money - Chinese companies want to get in on Boeing and Airbus' market. I don't have a dog in this fight, but I will say that Boeing isn't doing itself any favors with it's cost cutting efforts on the 737 MAX, and that if it wants to keep consumers trust in its planes over the perception of "inferior" foreign competition, it needs to work much more closely with the FAA to ensure safety is the primary motivating factor on new designs and does not get overriden by fuel efficiency.
- bagacrap 7y ago
  On the Boeing facility: "Work at the facility was limited to the plane’s interior, including installing seats and other cabin equipment. More responsibilities will be added over time, such as painting the exterior, but the center is primarily meant for completion and delivery, with the main manufacturing remaining in the US."
- benhurmarcel 7y ago
  They manufacture in China not mainly because it's cheaper (lots of places are cheaper than their home countries), but because it's the only way to get a significant part of the large Chinese market. > inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft This is true, but it was also true for European airliners in the US at a time. And it took time and effort, but it changed.
- markdown 7y ago
fuchingchong 7y ago
I find it interesting that on one hand the Chinese are extolling their technical prowess and on the other hand are stealing. Methinks doth project too much.
chvid 7y ago
How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?
- mc32 7y ago
  Same people who attribute attacks to North Korea and the Russian federation, etc.
- mywittyname 7y ago
  You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy. Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive. > Exactly what does it mean to be "state-sponsored"? It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf. > And who provides this analysis? Government agencies and private companies provide these types of analysis services.
- bsamuels 7y ago
  Without talking about the controversial technical indicators of a state sponsored attack, you can figure it out based on the motive, complexity of the attack, and who is being targeted. Criminal attacks have a profit related motive, which can be distilled down into "if we spend $X dollars trying to hack Y, we can probably get a payoff of $Z" If an attack is extremely expensive and has very little potential payoff, you can be pretty sure it's not being done by a criminal organization. You may wonder "how do you prove it's not being done by not-profit motivated hacktivists?". Hacktivist groups usually have limited resources (that doesn't mean they're not dangerous!). If scale of the attack/payload suggests a team of 10-30 skilled professionals working full time for a year or so, it's probably not a hacktivist group. Hacktivist groups also tend to proudly announce responsibility whenever they pull off successful attacks.
c3534l 7y ago
The way I figure, if a sophisticated attack is so sophisticated that it can only be state-sponsored, then it is sophisticated enough to appear to be sponsored by another country.
- pg_bot 7y ago
  Your problem here is ability and motive. What other countries are capable of executing this attack and would want to steal this information? As far as I know Comac is the only company that is attempting to build planes that rival Boeing and Airbus for commercial flight so you have your motive. The Chinese have a history of corporate espionage (lookup Huawei and Nortel) and given that Comac is a state owned company you can clearly understand why they would try to steal information. If you're trying to frame someone, there has to be a plausible explanation for why you would do it.
  - dirtyid 7y ago
    >Comac is the only company that is attempting to build planes that rival Boeing and Airbus Boeing also competes with Airbus, as in actively competes in real dollar terms compared to Comac which is more or less aspirational. Given their current situation they have as much incentive to hack Airbus, plus they've been accused recently: Airbus to sue NSA, German spies accused of swiping tech secrets >European aerospace giant Airbus is promising legal action over claims its top blueprints were stolen by German spies and given to America's intelligence agencies. https://www.theregister.co.uk/2015/04/30/airbus_us_german_intelligence/ https://www.theregister.co.uk/2015/04/30/airbus_us_german_in... My view is that both Boeing and Comac is actively stealing from airbus because why wouldn't they?
    - mikhailfranco 7y ago
      Yes, US/NSA/Boeing must at least be under suspicion in these circumstances. As the Comac C919 approaches certification and full production, airlines, especially Chinese ones, will delay orders, to wait and see, or actively prefer the C919 over the 737 series. Even if the C919 is delayed with the usual teething troubles, many customers will decide to wait, or buy Airbus if they have to. At this point, Boeing is the weakest of the three competitors in the mid-size market, and must be desperate to do anything to survive.
tempguy9999 7y ago
A question I've always wondered, and relevant here. If this is inter-company (and probably intra-company) communication, why don't these companies manually exchange one-time pads and use them? It's surely not hard for a courier to carry literally terabytes of OTP, and report if it was taken off them at any point. I was thinking of tape or HD, but now you an have the courier carry a terabyte of OTP in a few USB sticks.
- munificent 7y ago
  Let's say you do that: 1. Send giant HD of OTP bits to other office. 2. Everyone at that office who needs to communicate, so you make those bits accessible on the internal network so various machines can get to it. 3. Now a hacker that accesses the network can get to your OTP bits. At that point, you're no better than using some other security mechanism.
  - tempguy9999 7y ago
    Oh FFS. I was expecting some silly answer involving couriers being intercepted but this is just as bad. > 3. Now a hacker that accesses the network can get to your OTP bits. Which is on an internal network so is not exposed (unlike the contents of a VPN which necessarily goes external) so can be more secure. While nothing's unhackable it adds an extra layer to break through. That the article says "It was very sophisticated and targeted the VPN which connected the company to Airbus" shows the VPN was the weak link, and not the internal networks. So harden the weakest link.
potatofarmer45 7y ago
I used to complain so bitterly that the computers I had for AI research work, despite being a flavor of Linux, had no access to any sort of networking, making the installation of basic packages a pain. It turns out the safest way, barring spies who willingly steal, is provide no entry/exit points for data. For smaller organizations or small divisions that's feasible, but super hard to maintain at larger divisions.
- dmix 7y ago
  That's one way to get security... not a very practical one though.
- qaq 7y ago
  Having seen what a competent Red team can do that is not much of a barrier if information its valuable enough
gamescorner 7y ago
Britain benefitted from Industrial revolution because they looted natrual resources from their colonies, it was also unethical. Then those Anglos went to make America. Lot of Europe benefited from British industrialization, as technology and skill just flowed to the rest of the continent. To steal from Europe or America is unethical yes but to me it's justice served India should do the same. Why not steal technology? If India steals technology for better power plants and ends up lowering their carbon emission, what's wrong with that? If china steals adhesive technology from Germany (Henkle?) and ends up lowering their polluting their river, what's wrong with that? Stealing better technology to further development and reduce load on planet should be fundamental right. If people in India or China, simply can't afford better, greener, safer tech. Why shouldn't they steal IP and manufacture locally, which ends up improving quality of life of millions.
ga-vu 7y ago
Original report: https://www.france24.com/en/20190926-airbus-hit-by-series-of-cyber-attacks-on-suppliers https://www.france24.com/en/20190926-airbus-hit-by-series-of... Link to the actual source, please. This is a rehash (abhorrent blog spam) of a proper news report.
- dang 7y ago
  Thanks! Url changed from https://www.infosecurity-magazine.com/news/airbus-suppliers-hit-in/ https://www.infosecurity-magazine.com/news/airbus-suppliers-....
stefantalpalaru 7y ago
Boeing has a new safety scandal: https://komonews.com/news/local/exclusive-unexpected-cracking-found-on-critical-boeing-737ng-equipment https://komonews.com/news/local/exclusive-unexpected-crackin... The US is accusing the EU of illegally subsidising Airbus, while the EU is accusing the US of illegally subsidising Boeing. The conflict has reached the WTO. Now the US is threatening "to impose tariffs of up to 100% on European exports" - https://www.cnbc.com/2019/09/27/huge-trade-tariffs-on-europe-could-come-next-week-if-us-wins-wto-fight.html https://www.cnbc.com/2019/09/27/huge-trade-tariffs-on-europe... Tell me again how the first suspect that comes to mind in a case of systematic attacks on Airbus suppliers is... China.
zelon88 7y ago
> "Globally recognized standards, such as ISO 27001, 27701 and 9001, can definitely ensure a baseline of security, privacy and quality assurance amid suppliers. One should, however, bear in mind that they are no silver bullet and some additional monitoring of suppliers handling critical business data is a requisite.” This is misleading. ISO standards dictate that a company should have certain processes in place. Like quality assurance, customer satisfaction, continuous improvement, ect. They do not specify individual processes or procedures to the company. They just lay out which structures should exist in an ISO compliant company. It is up to the company to develop processes and procedures that fulfill those structures. The specific standards that are a "silver bullet" (as the author puts it) are NIST 800-171 "DFARS", ITAR, AS9100, NADCAP, and other smaller (yet equally significant) manufacturer-specific specifications that get flowed down the supply-chain on an as-needed basis. So there is no ambiguity. If a supplier does business with a diverse enough client base in aerospace they will almost certainly have overlapping systems in place to protect against these things. Without pretty much all of the specifications I listed above, a supplier would not legally limited in what they are allowed to possess and produce.
- dmix 7y ago
  Do companies with ISO certifications ever get reviewed after-the-fact? Or do you just have to check the right checkboxes during an initial review process?
  - zelon88 7y ago
    I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense. Basically an auditor comes and quizzes you on your own processes. You must show that you have processes which meet ISO criteria, and that you religiously follow those processes. Basically you have a lot of freedom to develop your business, just be sure you adhere to whatever you put into writing.
    - thombat 7y ago
      Back in the day of Total Quality Management and ISO9002 the software company I worked for decided to get itself certified. Problem was, nobody had a clue how to quickly describe the business of creating software as a set of processes, let alone apply them in measurable ways under the beady gaze of an auditor. So with evil inspiration it was decreed that the software division had no processes at all. The customers could rest assured that the Accounts and Marketing departments were fully ISO9002 compliant - as for the actual product they were buying? spun out of desperate sweat and divine revelations so far as they could tell. But this didn't entirely get the software division off the hook. We still had to be able to show an auditor that we knew our processes were excluded. So there was a special folder containing just one functional page besides the meta-bumf to support it, and it read (in effect) "THE ACTIVITIES OF THE SOFTWARE DEPT ARE EXCLUDED FROM ISO9002 PROCESSES". And we were all trained to be able to produce it upon demand. We passed the audit. Our letterhead paper gained the magical ISO9002 seal of approval. The administrator who had championed the long and expensive business sprung from its success to a much larger company. In her absence the process documentation for the rest of the company quietly withered and when the follow-up audit came due we quietly neglected to apply for it. The letterhead paper was reprinted with a snazzier logo and no seal of approval. We got back to work, quietly apprehending the next big thing.
ggm 7y ago
Without wanting to dive into the politics cesspool, In general I'd favour sharing IPR on RAND terms, rather than locking it up as special secret sauce. I think if Comac is struggling to learn how to make safe aircraft, then helping them is "build a better world" more than fighting them at the firewall.
Amendeson530 7y ago
What would be the point? The orders for planes are already done. And most airlines use either boeing or airbus. They couldn't just switch that easy.
peter303 7y ago
China

289 points by keydutch 7y ago

stanski 7y ago

I hear good things about this MCAS thing Boeing is doing. Maybe it's worth copying.

JadeNB 7y ago
Maybe you're being sarcastic, but this seems unrelated. The attacks are on internal networks with an attempt to gain unauthorised access to technical data; it seems to have nothing directly to do with attacks on the software that directly flies the plane.
- magduf 7y ago
  No, but perhaps it is coming from the same organization that thought MCAS was a great idea. After all, such an organization obviously has severe deficiencies with basic systems engineering; what other deficiencies might it have?
  - Tronno 7y ago
    The article clearly states China was believed to be responsible.
    - stevefan1999 7y ago
      ...what does Chinese gain from these attacks then? International infamy?
      - munmaek 7y ago
        Valuable aviation intel to use for their young, but growing, airline industry.
        netsharc 7y ago
        Makes me wonder if it'd be simpler to gain this stuff the old-fashioned spy way: bribe or blackmail someone working in one of those supplier companies. If Pierre in Toulouse is desperate to hide his affair with the Chinese girl he met a week ago in the bar...
        vonmoltke 7y ago
        Oh, that certainly happens as well. It's just harder to pull off, because physical security at these companies (even physical computer security) is well ahead of network security.
        magduf 7y ago
        Or the other way: just buy it outright. Either buy from the supplier companies, or buy existing stuff used and reverse-engineer it.
      - WillPostForFood 7y ago
        This isn't denial of service attack, this is unauthorized access to steal technical data.
        stevefan1999 7y ago
        I wouldn't call it cyberattack then; rather it should be cyberespionage
      - MS90 7y ago
        Stealing blueprints and other technical data so they can make their own knockoffs of western aircraft, as they have with the J-20 (F-22 knockoff) and J-31 (F-35 knockoff).
  - qubex 7y ago
    That’s a cheap shot and a risible one at that. The hierarchy of decision-makers who designed and implemented MCAS and the hierarchy of decision-makers who handle the information security at Boeing is (as I’m sure you’re well aware) so far removed and unrelated to each-other as to be essentially distinct. Conway’s Law doesn’t really apply here.
    - wil421 7y ago
      Exactly. A rogue bunch of MCAS engineers hacking Airbus is not based on any kind of reality.
  - wil421 7y ago
    Both of you provide some sources or anything more than “I could imagine X...because Boeing has been in the news lately.”.

JamesSchriver 7y ago

It is utterly fascinating to me how the west could have so completely and utterly lost its mind to so willingly and submissively capitulate and surrender, nay, self-sacrifice itself at the altar of foreign enemies that seem to now have possibly reached terminal state. It is akin to the constant muslim harassments and raids and invasions of Europe during a time of weakness in Europe along the Mediterranean in particular where a population was dispersed and too unorganized to fend off the constant muslim raids, enslavement, harassed, and invasion to the point that the muslims invaded on both the eastern and western fronts, only to hold Spain to varying degrees for 600 years. Today, China constantly raids and plunders the west of hard earned and produced technology and products and knowledge, while the ruling populace is weak in will and character, let alone principle, to hold back and defend against, let alone launch deterrent assaults on the clear enemy that is dismantling their whole culture and society bit by bit. I guess some in the self-immolating and self-hating and self-destructive west seem to believe that a world not stewarded by the west will somehow be a better place, when every single objective indicator clearly states that that will not at all be the case by a wide margin. Reality is that there are exactly zero scenarios where world stewardship will last in anything remotely resembling some kind of "equal" stewardship and say in all aspects. No, there is not a single path that does not lead to some one entity dominating the others, and the likelihood of the west being that leader again, is far fetched. So we are left with a prospect of Chinese strangulation of the world under communist oppression and tyranny akin to how it ruthlessly manages its chattel humans, only worse, because everyone else is not even Chinese. I don't think people have really started to even understand what has been done over the last several decades as the west has essentially not only dismantled itself, lost its identity, and even self-harmed and polluted and salted its soul. When there is a huge war that needs to be fought with hundreds of thousands of troops against the Chinese and possibly their numerous allies who have been promised spoils from the conquest of the west, who in the west will fight for the west? … the throngs of dissociated "immigrants" that have no loyalty or association or cultural affinity towards the west they freeload off and who's care about immediately dissipates once the benefits are withdrawn? The white men who have been degraded and disowned of their culture, identity, and lands as throngs of foreign legions of "immigrants" are teated better than they, the heirs of the men that created the civilized world we all benefit from while most immigrants and freeloading types revile and fully disrespect what they have yet never earned? Will white men be asked to go fight and die in a dysgenic war so foreigners that beset their lands can inherit the spoils either way? These are all real and legitimate questions that need to be asked. Who will defend this thing everyone loves freeloading off, yet does not want to contribute to, let alone respect the people who built it, even in their own homes? Good luck winning a massive war against Russian and Chinese forces with a demoralized western fighting force that does not know why it is fighting or defending, while the Chinese and their compatriots will be well aware that they are fighting to ascent to control.

joaomacp 7y ago

Out of curiosity: why is China not mentioned in the article's title, when the first sentence states a "Chinese state-sponsored hacking operation"?

eganist 7y ago
It took my vouch to un-dead your comment, useful because I couldn't reply to it otherwise. I'm morbidly fascinated as to how the top two comments on this submission were marked dead in the first place, but considering it took a vouch to automatically bring it back to life, there's a hint of a Flag brigade on this thread. To answer your comment: because the title of the submission "Airbus Suppliers Hit in State-Sponsored Attack" and the title of the article "Airbus Suppliers Hit in State-Sponsored Attack" are identical, and that's totally fine. Changing the title of the submission to include a detail from the article actually editorializes the submission, which is not ideal for HN or the audience here.
- jiveturkey 7y ago
  I took the comment to mean, why does the original article's title not have 'Chinese' in the title. In these days of click-bait "news", it's a valid question.
- yorwba 7y ago
  The user you're replying to has been leaving a trail of dead comments since https://news.ycombinator.com/item?id=14150381 https://news.ycombinator.com/item?id=14150381 If it's marked as [dead] but not [flagged], the comment was killed automatically. No reason to suspect brigading.
- dang 7y ago
  Please don't post insinuations of astroturfing or similar manipulation ("Flag brigade") without evidence. If you're concerned about abuse, please follow the site guidelines and email hn@ycombinator.com so we can look into it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

cde-v 7y ago

Seems like Boeing is getting pretty desperate to fix their MCAS issues.

raxxorrax 7y ago

My first question would be if the Chinese hacker is American looking or if he is named Boejing Wang or something like that. Jokes aside there are a huge number of mobile devices with saved credentials for exclusive business VPN access and a lot of businesses restrict access to resources based on the source of requests, which can be the corporate network of a supplier. This is often done to enable some forms of electronic data interchange. Putting these services in another network would probably have helped. It would be my guess that the hacker gained access through a privileged network with stolen VPN credentials. There would be countless ways to achieve that. Perhaps pickpockets should just sell the stolen phones to relevant companies.

taxidump 7y ago
I am not following your borderline racist comment about a name. Why do you assume stolen credentials? Low hanging fruit could be the entry point, but advanced attacks are common with state actors so this is highly assumptive and brings nothing to the discussion.

KoftaBob 7y ago

Interesting how Boeing and Airbus don't manufacture in China, and coincidentally China hasn't been able to produce any viable competitor to those products. Goes to show that without easy access to product blueprints/IP at the factories, China is very slow to actually innovate on their own. Hence why I feel the "China will outpace everyone in tech and take over the world" is super overblown. Even their university culture practically encourages cheating in classes to pass, so you have generations of students graduating with weak understanding of the fundamentals. The US is obviously not a perfect meritocracy, but China is super far from that. An economic model where American/European/Japanese/Korean tech is stolen and then friends of politicians are gifted CEO positions of companies that clone that stolen tech...not sustainable at all. If you want a painful example of what I'm talking about, watch the AI debate between Jack Ma and Elon Musk. It's so clear that Ma has an absolutely minuscule understanding of the AI landscape. When robotic manufacturing eventually becomes cheaper and faster than manufacturing in China, meaning they'll no longer have IP to steal, they are in huge trouble.

notahacker 7y ago
Airbus has been manufacturing in China for a while now and Boeing opened a plant more recently. China doesn't make internationally competitive aircraft because making internationally competitive aircraft is very hard.
- KoftaBob 7y ago
  "Asked about the possibility of technology transfer agreements between Boeing and COMAC, Bruns stressed that the purpose of the plant was for installing seats, painting vehicles, and completing the planes’ final delivery. “That’s only a part of what we do in the production of airplanes,” he said."
- mikepurvis 7y ago
  They're way behind schedule, but they are working on it. A recent Wendover video looked at the current state of affairs: https://www.youtube.com/watch?v=XjbYloKJX7c https://www.youtube.com/watch?v=XjbYloKJX7c
7y ago

rossdavidh 7y ago

So, it used to be that saying anything remotely skeptical about Bitcoin was the way to get downvoted on HN. Nowadays, it seems that saying anything negative about China is how. Although, in the field of aeronautics, it is not like China is the only "state sponsor" to engage in espionage, or that this is anything new for any of the major powers.

swarnie_ 7y ago
You want to try writing something vaguely anti-USA, that's when they really come out to get you.
avocado4 7y ago
HN / Reddit votes are very easy to manipulate with State-backed funding. Best to ignore the "consensus" on online boards and make one's own decision based on available evidence.
- dang 7y ago
  Please don't post insinuations about astroturfing without evidence. It poisons the well, and the overwhelming majority of such comments are based on imagination only. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20astroturfing&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
  - deleted 7y ago
    [deleted]
  - munificent 7y ago
    Honest guestion: I understand that unfounded allegations of astroturfing are not helpful. But does HN have systems in place to avoid malicious manipulation like this?
    - dang 7y ago

roymurdock 7y ago

Other comments here incorrectly pointing out that Boeing and Airbus don't manufacture in China - they do. And why wouldn't they, it's obviously much cheaper to manufacture there given material and labor costs. Obviously they don't manufacture highly sensitive military aircraft in China, but commercial aircraft, sure why not. What they don't do is the design, testing, and certification in China. This is the real IP - not the materials or the assembly techniques, but how to navigate the regulatory landscape of the FAA and the EASA in extremely complex hardware/software integrated systems. The article mentions certification documents/evidence as a primary target. The funny thing in all this is that passengers inherently trust the FAA and EASA operated system and inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft. When really this breach was all about the money - Chinese companies want to get in on Boeing and Airbus' market. I don't have a dog in this fight, but I will say that Boeing isn't doing itself any favors with it's cost cutting efforts on the 737 MAX, and that if it wants to keep consumers trust in its planes over the perception of "inferior" foreign competition, it needs to work much more closely with the FAA to ensure safety is the primary motivating factor on new designs and does not get overriden by fuel efficiency.

bagacrap 7y ago
On the Boeing facility: "Work at the facility was limited to the plane’s interior, including installing seats and other cabin equipment. More responsibilities will be added over time, such as painting the exterior, but the center is primarily meant for completion and delivery, with the main manufacturing remaining in the US."
benhurmarcel 7y ago
They manufacture in China not mainly because it's cheaper (lots of places are cheaper than their home countries), but because it's the only way to get a significant part of the large Chinese market. > inherently do not trust a Chinese-owned, manufactured, and regulated system for commercial aircraft This is true, but it was also true for European airliners in the US at a time. And it took time and effort, but it changed.
markdown 7y ago

fuchingchong 7y ago

I find it interesting that on one hand the Chinese are extolling their technical prowess and on the other hand are stealing. Methinks doth project too much.

chvid 7y ago

How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?

mc32 7y ago
Same people who attribute attacks to North Korea and the Russian federation, etc.
mywittyname 7y ago
You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy. Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive. > Exactly what does it mean to be "state-sponsored"? It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf. > And who provides this analysis? Government agencies and private companies provide these types of analysis services.
bsamuels 7y ago
Without talking about the controversial technical indicators of a state sponsored attack, you can figure it out based on the motive, complexity of the attack, and who is being targeted. Criminal attacks have a profit related motive, which can be distilled down into "if we spend $X dollars trying to hack Y, we can probably get a payoff of $Z" If an attack is extremely expensive and has very little potential payoff, you can be pretty sure it's not being done by a criminal organization. You may wonder "how do you prove it's not being done by not-profit motivated hacktivists?". Hacktivist groups usually have limited resources (that doesn't mean they're not dangerous!). If scale of the attack/payload suggests a team of 10-30 skilled professionals working full time for a year or so, it's probably not a hacktivist group. Hacktivist groups also tend to proudly announce responsibility whenever they pull off successful attacks.

c3534l 7y ago

The way I figure, if a sophisticated attack is so sophisticated that it can only be state-sponsored, then it is sophisticated enough to appear to be sponsored by another country.

pg_bot 7y ago
Your problem here is ability and motive. What other countries are capable of executing this attack and would want to steal this information? As far as I know Comac is the only company that is attempting to build planes that rival Boeing and Airbus for commercial flight so you have your motive. The Chinese have a history of corporate espionage (lookup Huawei and Nortel) and given that Comac is a state owned company you can clearly understand why they would try to steal information. If you're trying to frame someone, there has to be a plausible explanation for why you would do it.
- dirtyid 7y ago
  >Comac is the only company that is attempting to build planes that rival Boeing and Airbus Boeing also competes with Airbus, as in actively competes in real dollar terms compared to Comac which is more or less aspirational. Given their current situation they have as much incentive to hack Airbus, plus they've been accused recently: Airbus to sue NSA, German spies accused of swiping tech secrets >European aerospace giant Airbus is promising legal action over claims its top blueprints were stolen by German spies and given to America's intelligence agencies. https://www.theregister.co.uk/2015/04/30/airbus_us_german_intelligence/ https://www.theregister.co.uk/2015/04/30/airbus_us_german_in... My view is that both Boeing and Comac is actively stealing from airbus because why wouldn't they?
  - mikhailfranco 7y ago
    Yes, US/NSA/Boeing must at least be under suspicion in these circumstances. As the Comac C919 approaches certification and full production, airlines, especially Chinese ones, will delay orders, to wait and see, or actively prefer the C919 over the 737 series. Even if the C919 is delayed with the usual teething troubles, many customers will decide to wait, or buy Airbus if they have to. At this point, Boeing is the weakest of the three competitors in the mid-size market, and must be desperate to do anything to survive.

tempguy9999 7y ago

A question I've always wondered, and relevant here. If this is inter-company (and probably intra-company) communication, why don't these companies manually exchange one-time pads and use them? It's surely not hard for a courier to carry literally terabytes of OTP, and report if it was taken off them at any point. I was thinking of tape or HD, but now you an have the courier carry a terabyte of OTP in a few USB sticks.

munificent 7y ago
Let's say you do that: 1. Send giant HD of OTP bits to other office. 2. Everyone at that office who needs to communicate, so you make those bits accessible on the internal network so various machines can get to it. 3. Now a hacker that accesses the network can get to your OTP bits. At that point, you're no better than using some other security mechanism.
- tempguy9999 7y ago
  Oh FFS. I was expecting some silly answer involving couriers being intercepted but this is just as bad. > 3. Now a hacker that accesses the network can get to your OTP bits. Which is on an internal network so is not exposed (unlike the contents of a VPN which necessarily goes external) so can be more secure. While nothing's unhackable it adds an extra layer to break through. That the article says "It was very sophisticated and targeted the VPN which connected the company to Airbus" shows the VPN was the weak link, and not the internal networks. So harden the weakest link.

potatofarmer45 7y ago

I used to complain so bitterly that the computers I had for AI research work, despite being a flavor of Linux, had no access to any sort of networking, making the installation of basic packages a pain. It turns out the safest way, barring spies who willingly steal, is provide no entry/exit points for data. For smaller organizations or small divisions that's feasible, but super hard to maintain at larger divisions.

dmix 7y ago
That's one way to get security... not a very practical one though.
qaq 7y ago
Having seen what a competent Red team can do that is not much of a barrier if information its valuable enough

gamescorner 7y ago

Britain benefitted from Industrial revolution because they looted natrual resources from their colonies, it was also unethical. Then those Anglos went to make America. Lot of Europe benefited from British industrialization, as technology and skill just flowed to the rest of the continent. To steal from Europe or America is unethical yes but to me it's justice served India should do the same. Why not steal technology? If India steals technology for better power plants and ends up lowering their carbon emission, what's wrong with that? If china steals adhesive technology from Germany (Henkle?) and ends up lowering their polluting their river, what's wrong with that? Stealing better technology to further development and reduce load on planet should be fundamental right. If people in India or China, simply can't afford better, greener, safer tech. Why shouldn't they steal IP and manufacture locally, which ends up improving quality of life of millions.

ga-vu 7y ago

Original report: https://www.france24.com/en/20190926-airbus-hit-by-series-of-cyber-attacks-on-suppliers https://www.france24.com/en/20190926-airbus-hit-by-series-of... Link to the actual source, please. This is a rehash (abhorrent blog spam) of a proper news report.

dang 7y ago
Thanks! Url changed from https://www.infosecurity-magazine.com/news/airbus-suppliers-hit-in/ https://www.infosecurity-magazine.com/news/airbus-suppliers-....

stefantalpalaru 7y ago

Boeing has a new safety scandal: https://komonews.com/news/local/exclusive-unexpected-cracking-found-on-critical-boeing-737ng-equipment https://komonews.com/news/local/exclusive-unexpected-crackin... The US is accusing the EU of illegally subsidising Airbus, while the EU is accusing the US of illegally subsidising Boeing. The conflict has reached the WTO. Now the US is threatening "to impose tariffs of up to 100% on European exports" - https://www.cnbc.com/2019/09/27/huge-trade-tariffs-on-europe-could-come-next-week-if-us-wins-wto-fight.html https://www.cnbc.com/2019/09/27/huge-trade-tariffs-on-europe... Tell me again how the first suspect that comes to mind in a case of systematic attacks on Airbus suppliers is... China.

zelon88 7y ago

> "Globally recognized standards, such as ISO 27001, 27701 and 9001, can definitely ensure a baseline of security, privacy and quality assurance amid suppliers. One should, however, bear in mind that they are no silver bullet and some additional monitoring of suppliers handling critical business data is a requisite.” This is misleading. ISO standards dictate that a company should have certain processes in place. Like quality assurance, customer satisfaction, continuous improvement, ect. They do not specify individual processes or procedures to the company. They just lay out which structures should exist in an ISO compliant company. It is up to the company to develop processes and procedures that fulfill those structures. The specific standards that are a "silver bullet" (as the author puts it) are NIST 800-171 "DFARS", ITAR, AS9100, NADCAP, and other smaller (yet equally significant) manufacturer-specific specifications that get flowed down the supply-chain on an as-needed basis. So there is no ambiguity. If a supplier does business with a diverse enough client base in aerospace they will almost certainly have overlapping systems in place to protect against these things. Without pretty much all of the specifications I listed above, a supplier would not legally limited in what they are allowed to possess and produce.

dmix 7y ago
Do companies with ISO certifications ever get reviewed after-the-fact? Or do you just have to check the right checkboxes during an initial review process?
- zelon88 7y ago
  I'm pretty sure ISO 9001 companies are audited every 4 years at their own expense. Basically an auditor comes and quizzes you on your own processes. You must show that you have processes which meet ISO criteria, and that you religiously follow those processes. Basically you have a lot of freedom to develop your business, just be sure you adhere to whatever you put into writing.
  - thombat 7y ago
    Back in the day of Total Quality Management and ISO9002 the software company I worked for decided to get itself certified. Problem was, nobody had a clue how to quickly describe the business of creating software as a set of processes, let alone apply them in measurable ways under the beady gaze of an auditor. So with evil inspiration it was decreed that the software division had no processes at all. The customers could rest assured that the Accounts and Marketing departments were fully ISO9002 compliant - as for the actual product they were buying? spun out of desperate sweat and divine revelations so far as they could tell. But this didn't entirely get the software division off the hook. We still had to be able to show an auditor that we knew our processes were excluded. So there was a special folder containing just one functional page besides the meta-bumf to support it, and it read (in effect) "THE ACTIVITIES OF THE SOFTWARE DEPT ARE EXCLUDED FROM ISO9002 PROCESSES". And we were all trained to be able to produce it upon demand. We passed the audit. Our letterhead paper gained the magical ISO9002 seal of approval. The administrator who had championed the long and expensive business sprung from its success to a much larger company. In her absence the process documentation for the rest of the company quietly withered and when the follow-up audit came due we quietly neglected to apply for it. The letterhead paper was reprinted with a snazzier logo and no seal of approval. We got back to work, quietly apprehending the next big thing.

ggm 7y ago

Without wanting to dive into the politics cesspool, In general I'd favour sharing IPR on RAND terms, rather than locking it up as special secret sauce. I think if Comac is struggling to learn how to make safe aircraft, then helping them is "build a better world" more than fighting them at the firewall.

Amendeson530 7y ago

What would be the point? The orders for planes are already done. And most airlines use either boeing or airbus. They couldn't just switch that easy.

peter303 7y ago

China